LH Video Gen

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:36 AM UTC
• Version: 1.0.0

Overview

This skill mostly matches video generation, but it includes under-disclosed promotional branding and an optional custom TTS command that can run arbitrary shell commands.

Review and edit the templates before publishing generated videos, especially if you do not want the built-in branding or promotional closing. Avoid using --tts-command unless you fully trust the exact command string and the script content being passed to it. Treat Markdown inputs as trusted content, and use a dedicated output/temp directory if scripts may contain sensitive text.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: templates/script-template.md:4

Finding

Undisclosed Hardcoded Branding and Promotional Output Manipulation

Content

View full analysis

- 结尾固定引导语："关注刘贺同学" > - 总时长 30-40 秒（4 段为宜） ``` From `templates/script-template.md:32-35`: ```markdown ## 结尾 **画面**：关注引导页面 **口播**：我是龙虾哥，关注刘贺同学，下期见！ **字幕**：关注「刘贺同学」\n下期见！ ``` From `templates/slide.html:151-155`: ```html

🦞 龙虾哥

``` From `templates/slide-ai-bg.html:101-104`: ```html

🦞 龙虾哥

``` ### Technical Analysis The bundled script template presents a fixed promotional call-to-action as a required script-design rule. Independently, both slide templates contain hardcoded branding with no configuration option to remove or replace it. The active rendering path uses `templates/slide.html`, so every slide generated without `--images-dir` receives the hardcoded branding. An agent that follows the bundled script template will also add the fixed promotion to the spoken dialogue and visible subtitles. This manipulates user-facing output rather than compromising operating-system privileges. It is classified as instruction hijacking because bundled Skill instructions alter the requested content by introducing an unrelated promotional objective. ### Attack Path 1. A user or agent loads the Skill and follows ...[truncated 976 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate.py:190

Finding

Arbitrary JavaScript and HTML Injection Through Markdown Slide Content

Content

View full analysis

").replace("\n", "
") visual_html = visual.replace("\\n", "
").replace("\n", "
") html = template.replace("{{SUBTITLE}}", subtitle_html) html = html.replace("{{VISUAL}}", visual_html) html = html.replace("{{INDEX}}", str(index)) ``` From `templates/slide.html:181-195`: ```html

Remediation

View remediation

` elements between those text nodes. 5. If values must be passed into JavaScript, serialize them with `json.dumps()` rather than constructing quoted literals manually. 6. If limited HTML formatting is required, sanitize it using a strict allowlist that permits only necessary elements such as `
` and prohibits attributes. 7. Add a restrictive Content Security Policy that blocks inline scripts, remote scripts, plugins, and unnecessary network connections. 8. Run Chrome with network access disabled or isolated when rendering untrusted documents. 9. Treat Markdown input as untrusted and add tests covering: - Single and double quotes. - `` sequences. - Event-handler attributes. - Embedded tags. - Newlines and backslashes. 10. Verify the Chrome subprocess return code and fail securely if rendering does not complete successfully. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (18)

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Allowing callers to provide an arbitrary shell command for TTS exceeds the minimum capability needed for Markdown-to-video generation and creates a direct execution primitive. In this skill context, the feature is especially dangerous because it appears as a convenience option in a media tool, so users may not expect that invoking the skill can run unrelated system commands.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

This is a classic tool-parameter abuse issue: a user-controlled parameter is treated as executable shell logic rather than data, giving the caller a general command execution capability. Because this skill is intended for video generation, not arbitrary system administration, the capability is unjustified and materially increases the attack surface.

Content

Scanner excerpt · scripts/generate.py (reported line 164)May include surrounding context.

python

voice=shlex.quote(voice),
            rate=shlex.quote(rate),
        )
        result = subprocess.run(cmd_str, shell=True, capture_output=True, text=True)
    else:
        tts_path = _detect_tts()
        cmd = [

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill clearly describes capabilities that require shell execution, filesystem reads/writes, and environment-variable access, yet it declares no tool scope or permission boundaries. This makes the operational trust boundary implicit, increasing the chance that an agent will run powerful actions without clear user visibility or policy enforcement.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Most user-facing instructions and parameter explanations are written in Chinese, which effectively imposes a language requirement without opt-in or an alternative locale. Under the policy, forcing a specific language without user choice is a natural-language policy concern unless explicitly justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The custom TTS command feature allows execution of arbitrary external programs with user-provided script text and output paths substituted into the command template. Without a warning, users may unknowingly send sensitive content to third-party tools/services or enable command-injection risk if the implementation performs unsafe shell interpolation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The CLI help advertises a custom command template for TTS without clearly warning that it results in shell execution, which can mislead users into treating it as a normal formatting option. This amplifies the risk of accidental unsafe use and makes exploitation more plausible in automation contexts where parameters may be externally influenced.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/generate.py (reported line 97)May include surrounding context.

python

missing = []

    try:
        subprocess.run(["ffmpeg", "-version"], capture_output=True, check=True)
    except (subprocess.CalledProcessError, FileNotFoundError):
        missing.append("FFmpeg（需安装：brew install ffmpeg）")

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 99% confidence

Finding

This code builds a command string from a user-supplied --tts-command template and executes it with shell=True, enabling arbitrary OS command execution in the context of the running process. Even though some placeholders are shell-quoted, the template itself is attacker-controlled, so a caller can supply extra commands or destructive shell syntax unrelated to TTS generation.

Content

Scanner excerpt · scripts/generate.py (reported line 164)May include surrounding context.

python

voice=shlex.quote(voice),
            rate=shlex.quote(rate),
        )
        result = subprocess.run(cmd_str, shell=True, capture_output=True, text=True)
    else:
        tts_path = _detect_tts()
        cmd = [

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/generate.py (reported line 174)May include surrounding context.

python

"-r", rate,
            "-o", output_path,
        ]
        result = subprocess.run(cmd, capture_output=True, text=True)

    if result.returncode != 0:
        print(f" TTS 生成失败：{result.stderr}")

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/generate.py (reported line 231)May include surrounding context.

python

"-r", rate,
            "-o", output_path,
        ]
        result = subprocess.run(cmd, capture_output=True, text=True)

    if result.returncode != 0:
        print(f" TTS 生成失败：{result.stderr}")

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/generate.py (reported line 252)May include surrounding context.

python

"-r", rate,
            "-o", output_path,
        ]
        result = subprocess.run(cmd, capture_output=True, text=True)

    if result.returncode != 0:
        print(f" TTS 生成失败：{result.stderr}")

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/generate.py (reported line 277)May include surrounding context.

python

"-r", rate,
            "-o", output_path,
        ]
        result = subprocess.run(cmd, capture_output=True, text=True)

    if result.returncode != 0:
        print(f" TTS 生成失败：{result.stderr}")

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/generate.py (reported line 298)May include surrounding context.

python

"-r", rate,
            "-o", output_path,
        ]
        result = subprocess.run(cmd, capture_output=True, text=True)

    if result.returncode != 0:
        print(f" TTS 生成失败：{result.stderr}")

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/generate.py (reported line 211)May include surrounding context.

python

"file://" + str(temp_html.absolute()),
    ]

    subprocess.run(cmd, capture_output=True)
    temp_html.unlink()

    if not os.path.exists(output_path):

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The template is entirely prescriptive in Chinese and requires fixed Chinese closing phrases such as "关注刘贺同学", which effectively forces a specific language/locale for generated content. The file does not indicate that this is optional, user-selected, or justified as a region-specific template.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The documentation tells users how to generate output but does not warn that the skill writes MP4s, temporary images, audio, and intermediate artifacts to disk. This can lead to accidental data retention, storage misuse, or exposure of sensitive script content in temp directories, especially on shared systems.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The HTML root sets lang="zh", which hard-codes the document language to Chinese. Under the policy, forcing a specific language without user opt-in or clear justification is a natural-language locale violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The HTML document declares lang="zh-CN", and the template content/comments branding are oriented to Chinese without indicating that this is optional or region-specific. The audit rule flags language or locale constraints when a skill forces a specific language without user opt-in or clear justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.